Deployment Architecture

Ingest Netflow Data using Windows, Linux, Cisco Netflow


I would like some advice on what is the best way to implement the following solution.

I would like to get netflow data to Splunk Enterprise running on Windows server that is coming from cisco devices using netflow-exporter.

The problem is windows has a winpcap vulnerability and I would rather not use any add ons that contain that wpcap.dll.

My solution would be to set up a Linux server to use the universal forwarder to ingest the netflow data and parse that to Splunk enterprise on Windows without any add ons.

I am having a hard timevdetermining if this is possible or will I require a TA on Splunk enterprise?

Tags (3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!